I have created new user with VPN access only. Network Access checkbox is UNCHECKED.

There are no firewall rules to route traffic between OfficeMode and other subnet (wired/wireles bridge in my case)

I establish L2PT connection and put int he OffieMode subnet (so far so good).

However at this point from my clent I can telnet to machine in my wired subnet. Why?!

I don't think I should be able to reach other subnets from OfficeMode. Security is set to Med

Access from Office Mode is configured either via bypass the default firewall policy in the VPN server page or via security rules

"Network Access" is not related to VPN, it is used for NAC.